Bug 440120 – [mpegdemux] crashes in gst_mpeg_demux_send_subbuffer() with wrongly-typefound quicktime files

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 440120 - [mpegdemux] crashes in gst_mpeg_demux_send_subbuffer() with wrongly-typefound quicktime files


Summary:	[mpegdemux] crashes in gst_mpeg_demux_send_subbuffer() with wrongly-typefound...


Status:	RESOLVED FIXED

Product:	GStreamer
Classification:	Platform
Component:	gst-plugins-ugly
Version:	0.10.5
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	0.10.6
Assigned To:	GStreamer Maintainers
QA Contact:	GStreamer Maintainers

URL:
Whiteboard:

Duplicates:	517441 (view as bug list)
Depends on:
Blocks:

Reported:	2007-05-21 08:19 UTC by Sebastien Bacher
Modified:	2008-02-19 17:23 UTC

See Also:
GNOME target:	---
GNOME version:	2.17/2.18

Description Sebastien Bacher 2007-05-21 08:19:58 UTC

The bug has been opened on https://bugs.launchpad.net/ubuntu/+source/gst-plugins-ugly0.10/+bug/93057

"Binary package hint: totem

Open http://www.ehrensenf.de/2007/03/16/solar-streitwagen-stummfilm-klassiker-ehrensenf-story/?vid=Quicktime
in Firefox 2.0.0.2 (ubuntu feisty fawn) and click on play.
No video appers, totem crashed, but firefox not.
...
Debug crash backtrace:

+ Trace 135296

Thread 31 (process 28138)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 fts_read
from /lib/tls/i686/cmov/libc.so.6
#2 g_main_context_iterate
at gmain.c line 2979
#3 IA__g_main_loop_run
at gmain.c line 2881
#4 IA__gtk_main_do_event
at gtkmain.c line 1320
#5 main

Thread 30 (process 28140)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 __nanosleep_nocancel
from /lib/tls/i686/cmov/libpthread.so.0
#2 IA__g_usleep
at gtimer.c line 170
#3 gst_xvimagesink_event_thread
at xvimagesink.c line 1451
#4 g_thread_create_proxy
at gthread.c line 591
#5 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#6 ioperm
from /lib/tls/i686/cmov/libc.so.6
#7 ??

Thread 29 (process 28141)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_system_clock_async_thread
at gstsystemclock.c line 261
#3 g_thread_create_proxy
at gthread.c line 591
#4 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#5 ioperm
from /lib/tls/i686/cmov/libc.so.6
#6 ??

Thread 28 (process 28146)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 27 (process 28147)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 26 (process 28148)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 25 (process 28149)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 24 (process 28150)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 23 (process 28151)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 22 (process 28152)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 21 (process 28153)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_timedwait
from /lib/tls/i686/cmov/libpthread.so.0
#2 g_cond_timed_wait_posix_impl
at gthread-posix.c line 242
#3 g_async_queue_pop_intern_unlocked
at gasyncqueue.c line 341
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 220
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 20 (process 28154)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 19 (process 28155)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 18 (process 28156)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 17 (process 28157)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 16 (process 28158)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 15 (process 28159)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 14 (process 28160)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 13 (process 28161)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 12 (process 28162)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 11 (process 28163)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 10 (process 28164)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 9 (process 28165)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 8 (process 28166)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 7 (process 28167)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 6 (process 28168)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 5 (process 28169)

#0 _dl_sysinfo_int80
from /lib/ld-linux.so.2
#1 pthread_cond_wait
from /lib/tls/i686/cmov/libpthread.so.0
#2 gst_queue_loop
at gstqueue.c line 885
#3 gst_task_func
at gsttask.c line 163
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#5 g_thread_create_proxy
at gthread.c line 591
#6 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#7 ioperm
from /lib/tls/i686/cmov/libc.so.6
#8 ??

Thread 4 (process 28170)

#0 ioperm
from /lib/tls/i686/cmov/libc.so.6
#1 ??
#2 ??

Thread 3 (process 28171)

#0 ioperm
from /lib/tls/i686/cmov/libc.so.6
#1 ??
#2 ??

Thread 2 (process 28172)

#0 ioperm
from /lib/tls/i686/cmov/libc.so.6
#1 ??
#2 ??

Thread 1 (process 28145)

#0 gst_mpeg_demux_send_subbuffer
at gstmpegdemux.c line 994
#1 gst_dvd_demux_send_subbuffer
at gstdvddemux.c line 997
#2 gst_mpeg_demux_parse_packet
at gstmpegdemux.c line 732
#3 gst_mpeg_parse_chain
at gstmpegparse.c line 744
#4 gst_pad_chain_unchecked
at gstpad.c line 3436
#5 gst_pad_push
at gstpad.c line 3609
#6 gst_type_find_element_chain
at gsttypefindelement.c line 570
#7 gst_pad_chain_unchecked
at gstpad.c line 3436
#8 gst_pad_push
at gstpad.c line 3609
#9 gst_proxy_pad_do_getrange
at gstghostpad.c line 203
#10 gst_pad_chain_unchecked
at gstpad.c line 3436
#11 gst_pad_push
at gstpad.c line 3609
#12 gst_base_src_loop
at gstbasesrc.c line 1601
#13 gst_task_func
at gsttask.c line 163
#14 g_thread_pool_thread_proxy
at gthreadpool.c line 265
#15 g_thread_create_proxy
at gthread.c line 591
#16 start_thread
from /lib/tls/i686/cmov/libpthread.so.0
#17 ioperm
from /lib/tls/i686/cmov/libc.so.6
#18 ??

Comment 1 Tim-Philipp Müller 2007-05-21 09:06:04 UTC

I've seen a crash in gst_mpeg_demux_send_subbuffer() once before, but was never able to get a file I can reproduce it with.


In this case, I'm not really sure what's happening. The video embedded on the website above seems to be a quicktime video, no mpeg demux involved anywhere.

Does anyone still have the .mpg file that causes the crash?

Comment 2 Jan Schmidt 2007-05-21 09:39:58 UTC

Remember that the old MPEG typefinder used to sometimes mis-read QT files as MPEG, which could easily cause this.

My re-write from the other day should prevent that, I hope. It certainly seems to work for all the test files I have.

Comment 3 Tim-Philipp Müller 2007-05-21 15:11:07 UTC

> Remember that the old MPEG typefinder used to sometimes mis-read QT files as
> MPEG, which could easily cause this.

Ah, that makes sense. Managed to reproduce the problem with one of my quicktime samples. Should be fixed in CVS now:
 
  2007-05-21  Tim-Philipp Müller  <tim at centricular dot net>

        * gst/mpegstream/gstmpegdemux.c: (gst_mpeg_demux_send_subbuffer):
          Add sanity check so we don't abort for broken or non-MPEG streams,
          but instead error out. Fixes crashes/aborts for when our typefinder
          wrongly identifies quicktime files as mpeg (which should be fixed in
          -base now too). (#440120).

Comment 4 Tim-Philipp Müller 2008-02-19 17:23:08 UTC

*** Bug 517441 has been marked as a duplicate of this bug. ***